﻿<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[(Level="2") and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]] and *[System[Provider[@Name="Microsoft-Windows-IIS-APPHOSTSVC"]]]</Select>
    <Select Path="System">*[System[(Level="2") and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]] and *[System[Provider[@Name="Microsoft-Windows-IIS-FTP"]]]</Select>
    <Select Path="System">*[System[(Level="2") and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]] and *[System[Provider[@Name="Microsoft-Windows-IIS-IisMetabaseAudit"]]]</Select>
    <Select Path="System">*[System[(Level="2") and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]] and *[System[Provider[@Name="Microsoft-Windows-IIS-IISReset"]]]</Select>
    <Select Path="System">*[System[(Level="2") and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]] and *[System[Provider[@Name="Microsoft-Windows-IIS-W3SVC"]]]</Select>
    <Select Path="System">*[System[(Level="2") and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]] and *[System[Provider[@Name="Microsoft-Windows-IIS-W3SVC-PerfCounters"]]]</Select>
    <Select Path="System">*[System[(Level="2") and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]] and *[System[Provider[@Name="Microsoft-Windows-IIS-W3SVC-WP"]]]</Select>
    <Select Path="System">*[System[(Level="2") and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]] and *[System[Provider[@Name="Microsoft-Windows-IIS-WMSVC"]]]</Select>
    <Select Path="System">*[System[(Level="2") and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]] and *[System[Provider[@Name="Microsoft-Windows-WAS"]]]</Select>
    <Select Path="System">*[System[(Level="2") and TimeCreated[timediff(@SystemTime) &lt;= ##TimeRange##]]] and *[System[Provider[@Name="Microsoft-Windows-WAS-ListenerAdapter"]]]</Select>
  </Query>
</QueryList>